mmt[.]portal-hubs[.]sbs

The domain mmt.portal-hubs.sbs has been flagged for brand impersonation, specifically targeting Google. Analysis confirms the domain was actively mimicking Google’s branding and interface, as evidenced by the page title 'Google.' The domain is currently offline, but prior activity raises concerns regarding its intent and infrastructure. Infrastructure analysis reveals the domain was registered on October 21, 2025, through Dynadot LLC. It resolved to the IP address 142.250.186.36 and was detected by 10 of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist and was previously blocked by automated threat detection systems. The creation date, combined with the rapid detection by multiple vendors, suggests a coordinated attempt to deceive users by leveraging a trusted brand. At present, mmt.portal-hubs.sbs is offline, reducing immediate risk to end users. However, the domain’s infrastructure and historical activity warrant continued monitoring. Organizations are advised to review logs for connections to the IP address 142.250.186.36 and the domain itself. Security teams should update blocklists to include this domain and its associated indicators, while users should remain vigilant for similar impersonation attempts. Proactive measures, such as domain reputation checks and employee training on brand impersonation threats, are recommended to mitigate future risks.